CVE-2026-123779

{
  "etk_id": "ETK-2026-3948",
  "cve_id": "CVE-2026-123779",
  "display_id": "CVE-2026-123779",
  "ghsa_id": "GHSA-f58r-c62m-574f",
  "euvd_id": "EUVD-2026-119978",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Metadata disclosure bypass in Apache Axis2/Java",
  "summary": "Apache Axis2/Java through 2.0.1 may disclose service metadata even when metadata exposure is disabled. Anonymous callers can obtain information such as operation names and request or response schemas through routes that did not enforce the setting. Affected deployments expose the Axis2 HTTP transport or OpenAPI-related endpoints.",
  "mitigation": "Upgrade org.apache.axis2:axis2-transport-http and org.apache.axis2:axis2-openapi to version 2.0.2. Until upgraded, restrict unauthenticated access to Axis2 metadata, service-listing, OpenAPI, Swagger UI, and related catalog endpoints.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Axis2/Java",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.0.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.0.2"
      ],
      "package_name": "org.apache.axis2:axis2-transport-http",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.0.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.0.2"
      ],
      "package_name": "org.apache.axis2:axis2-openapi",
      "purl": null
    }
  ],
  "cwes": [
    425
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.136841333333333,
  "t0_at": "2026-11-09T10:29:30.229000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-09T10:29:30.229000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T10:29:30.229000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-123779"
    }
  }
}